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Patent 



I. 



Real Party in Interest 



The real party in interest in this appeal is Pitney Bowes Inc., a Delaware 
corporation, the assignee of this application. 



There are no appeals or interferences known to Appellants, their legal 
representative, or the assignee that will directly affect or be directly affected by or have 
a bearing on the Board's decision in this appeal. 



Claims 1-6, 8-20 and 22-32 are in the case and under final rejection of the 
Examiner rejected under 35 U.S.C. § 103(a) as allegedly being rendered obvious by 
U.S. Patent No. 5,367,464 to Abumehdi, et al. ("Abumehdi "464") in view of U.S. Patent 
No. 6,061 ,668 to Sharrow ("Sharrow l 668 n ). 

Claims 7 and 21 are in the case and under final rejection of the Examiner 
rejected under 35 U.S.C. § 103(a) as allegedly being rendered obvious by U.S. Patent 
No. 5,367,464 to Abumehdi, et al. ("Abumehdi '464") in view of U.S. Patent No. No. 
6,061 ,668 to Sharrow ("Sharrow '668") and further in view of U.S. Patent No. 5,778,076 
to Kara, et al. ("Kara '076"). 

Appellants hereby appeal the rejection of claims 1-32. 

IV. Status of Amendments 

There are no amendments to the claims filed subsequently to the final rejection 
of September 22, 2004. Therefore, the claims set forth in Appendix A to this brief are 
those as set forth before the final rejection. 
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V. Summary of Claimed Subject Matter 

Appellants' invention relates to methods and systems for providing security for a 
database by generating and maintaining audit data that is used to audit and verify the 
database. Figure 1 is reproduced below for use in a summary discussion of an 
illustrative embodiment 



-10 




FIG. 1 

Each user 12 is provided access to a particular meter record in the meter record 
database 20 using one of a plurality of cryptographic modules 22 to process the 
postage transaction. Any available cryptographic module is used each time the 
customer requests postage and the modules may operate independently due to the 
audit systems described. Audit data is updated and stored in each module 22 and can 
be compared to audit data stored in the server 20. (Specification at page 3, line 27- 
page 4, line 10; page 5, lines 20-23, page 6, lines 1-26.) 

Additional features of the invention are discussed below in the Argument section 
of this Brief. This summary is not intended to supplant the description of the claimed 



noo35a52.i y 4/23 March 21 , 2005 Appellants' Appeal Brief 

PAGE 6/25 * RCVD AT 3/21/2005 5:04:34 PM {Eastern Standard Time] * SVR:USPTO-EFXRF-1/7 * DN1S: 8 729308 * CSID:203 924 3919 ■ DURATION (mm-ss):1(M4 



MAR 21 2005 17:04 FR INTELLECTUAL PROPERTY3 924 3919 TO 917038729306 P. 



07 



Serial No.: 09/654,951 Patent 
Attorney Docket No.: MOO 



subject matter as provided in the claims as recited in Appendix A, as understood in light 
of the entire specification. 

VI. Grounds of rejection to Be Reviewed on Appeal 
Whether claims 1-32 are patentable under 35 U.S.C. §103(a). 

VII. Argument 

This is now the second Appeal Brief submitted in the instant application as the 
Appeal Brief filed on January 14, 2004 was rendered moot when the Examiner withdrew 
the finality of the then final rejection and reopened prosecution. 

As Appellants discuss in detail below, the final rejection of several of claims 1-32 
is unsupported by the references cited. It is respectfully submitted that the rejection 
does not even meet the threshold burden of presenting a prima facie case of 
unpatentability. For this reason alone, Appellants are entitled to grant of a patent. In re 
Oetiker. 24 U.S.P.Q.2d 1443, 1444 (Fed. Cir. 1992). 

A. The Abumehdi '464 and Sharrow '668 References are Not Properly 
Combined Under 35 U.S.C. Section 103(a) 

The Sharrow '668 reference is not properly combined with the Abumehdi '464 
reference. The Sharrow '668 reference does not appreciate a problem of a plurality of 
modules maintaining transaction audit data that is also reflected in a separate database 
such that the audit data from the two locations can be compared. As shown below, 
Sharrow does not even teach or fairly suggest any audit of data and there is absolutely 
no suggestion or motivation to combine the references. 

In the September 22, 2004 Final Rejection, the Examiner attempts to support the 

combination of the references by stating that: 

[l]n this case, Abumehdi teaches a central terminal maintains 
transactions data from plurality of modules. Final Rejection at page 2. 
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Appellants argued that it is clear from Abumehdi '464 at Col. 1, lines 10-48 and 
Col. 3, lines 3-65 that only one module could access the credit update amount record. 
Such update record has a one-to-one correspondence with the one franking meter. 
Accordingly, Abumehdi '464 specifically teaches away from allowing access to that 
particular record using more than one module. One of ordinary skill in the art would be 
led in a direction divergent from that taught in the invention as presently claimed after 
having read Abumehdi '464. Accordingly, the references are not properly combined and 
the rejection should be reversed. See Monarch Knitting Mach. Corp. v. Sulzer Morat 
GmbH, 139 F. 3d 877 (Fed. Cir. 1998). 

In response to Appellants argument that there is no motivation to combine the 

references, the Examiner, in the Final Rejection at pages 2-3 acknowledged the 

requirement of some teaching, suggestion or motivation to combine the references 

found in the references themselves or the general knowledge of one of skill in the art. 

Citing in re Fine, 837 F.2d 1071 , 5 USPQ2d 1596 (Fed. Cir. 1998) and In re Jones, 958 

F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). However, the Examiner then proceeded 

to attempt to support the combination of the references by stating that: 

it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to add the features [allegedly found in 
Sharrow '668] of summing the audit data of each of said modules to 
generate the system audit data, and verifying the database's integrity 
against the system audit data in Aubumehdi's teaching because it would 
increase the overall consistency of the modules. Final Rejection at pages 
4-5. 

As the Federal Circuit has held, "[l]t is impermissible to use the claimed invention 
as an instruction manual or 'template' to piece together the teachings of the prior art ..." 
See In re Rtch, 972 F.2d 1260, 23 USPQ2d 1780, 1784 (Fed. Cir. 1992)(quoting In re 

Fine, 837 F.2d 1071, 1075 (Fed. Cir. 1998). The cited prior art does not provide even a j 

i 

hint of a problem of auditing database records that may be modified by any of a plurality j 
of input modules. As previously admitted by the Examiner in the earlier July 14, 2003 
Final Office Action, Abumehdi '464 discusses only one input module to access a record. 
As described below, the cited prior art does not even show a plurality of input modules 
and Sharrow '668 does not even contemplate an audit of a database record. The 



{KU3SBS2.1 ) 6/23 March 21 , 2005 Appellants' Appeal Brief 

PACE 8/25* RCVD AT 3/21/2005 5:04:34 PM [Eastern Standard Time] * 8VR:USPT<*EFXRF-1/7 * DNJB:8729306 * CSID:203 924 3919 » DURATION (mm-ss): 10-44 



MAR 21 2005 17:05 FR INTELLECTUAL PROPERTY 3 924 3919 TO 917038729306 



P. 09 

| 



Serial No.: 09/654,951 Patent 
Attorney Docket No.: F-100 



Examiner cited to the following passages of Sharrow '668 to allegedly teach summing 

i 

audit data: 

The central management computer checks for an acknowledgment 
for each transmission sent, and sends an acknowledgment for every data 
transmission correctly received. In the event an acknowledgment is not 
received, the transmission is repeated a preset number of times, after 
which a maintenance report is generated, so that an inoperative appliance 
or machine, or network fault, is repaired promptly. Sharrow '668 col. 3, 
lines 24-30. 

When the users make a selection, the appliance or machine 
controller communicates this data to the central management computer 10 
via the network. The central management computer 10 checks its 
database for the price to be charged for the appliance or machine cycle 
selected by the users, and sends a message to the users informing them 
that their account will be billed the stated amount for the selected use, and 
asking that they choose to proceed or to cancel. Sharrow '668 col. 5 f 
lines 46-54. 

The request is transmitted from appliance 14, via the network cable 
11, to the central management computer 10. The central management 
computer 10 sends a request for account verification 620, via PMS data 
cable 18, to the property management system 19. Sharrow '668 col. 7, 
lines 20-24. 

However, as shown from the following passages that were not cited, the account 
verification is to determine if the user is authorized to process the transaction. 

The property management system 19 checks its data base 618 to 
see if a guest is registered in room #103, and if the registered guest has 
authorized charges for use of the clothes washer. 

The property management system 19 replies, via PMS data cable 
18, to the central management computer 10, in the affirmative or negative, 
depending on the information retrieved from its database. 

If the central management computer 10 received a negative 
response from the property management system 19, a message is sent 
622, via the network cable 1 1 , to appliance 14, which is presented on the 
display readout of appliance 14, notifying that the user that the account for 
room #103 is not valid or use of the clothes washer has not been 
authorized, and that the user should contact the front desk at extension 
#808 for assistance. The controller is then reset 616, in preparation for the 
next user selection. 

if the central management computer 10 received an affirmative 

response from the property management system 1 9, a message is sent j 

624, via the network cable 11, to appliance 14, instructing the user to j 

select the desired wash cycle. j 

i 
i 
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Appliance 14, via network cable 11, sends a request 626 to central 
management computer 10, indicating the wash cycle that the user has 
selected. Sharrow '668 col. 7, lines 25-49. 

Appellants respectfully submit that Sharrow does not contemplate or fairly 

suggest any type of record auditing and that the Examiner's alleged reason for such 

combination in providing greater data consistency cannot be supported. For example, 

in a portion of Sharrow '668 that is not cited by the Examiner, Sharrow describes: 

If they elect to proceed, the central management computer 10 
opens a transaction file that records the unique identification code of the 
appliance or machine, the cycle selected by the user, the price quoted, 
and the date and time the election to proceed was made, then the central 
management computer 10 sends an instruction to the specific appliance or 
machine, enabling it to run the cycle or mode selected by the user. 
Sharrow '668 col. 5, lines 58-65. 

Nowhere does Sharrow '668 teach or fairly suggest audit data at all or even 

auditing records at all. There is absolutely no motivation to combine the reference for 

such a purpose. Nowhere in Sharrow '668 is there a discussion of verifying that 

database record using separate audit data . The Examiner states: 

It would have been obvious to one of ordinary skill in the art at the 
time the invention was made to add the features fallegedlv found in 
Sharrow '6681 of summing the audit data of each of said modules to 
generate the system audit data, and verifying the database's integrity 
against the system audit data in Aubumehdi's teaching because it would 
increase the overall consistency of the modules. Final Rejection at pages 
4-5, bracketed comment added for clarity. 

However, Sharrow does not appreciate the need for any audit of data as shown i 
from the citation above. Sharrow teaches no audit and exactly contrary to the 
Examiner's assertion, Sharrow could not possibly "increase overall consistency of the 
modules" and more importantly as Sharrow '668 does not contemplate any type of 
audit it could not even determine if there was an inconsistency In the data 
record . 

The Examiner shows no reference or knowledge to support even an appreciation 

i 

of a problem of auditing records that may be modified by any of a plurality of input j 

i 

! 
I 

i 

i 
I 
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modules. See also Monarch Knitting Mach. Corp. v. Sulzer Morat GmbH, 139 F. 3d 877 
(Fed. Cir. 1998). 

Appellants have also argued that the references were not properly combined as 
non-analogous art. The invention as presently claimed relates to auditing and verifying 
the integrity of database records that may be alternatively modified by a plurality of 
independent modules. An illustrative embodiment is a virtual postage meter system 
having a plurality of cryptographic modules that may alternatively be used to modify a 
single virtual postage meter postage value record for a particular customer. While 
Abumehdi '464 is a reference in the postage meter art, Sharrow '668 is directed to pay- 
per-use appliances. The rejections should be reversed because the references are not 
in an art analogous to that of the invention as presently claimed. See Wang Lab., Inc. v. 
Toshiba Corp., 993 F. 2d 858, 26 USPQ2d 1767 (Fed. Cir. 1993). 

Accordingly, the references are not properly combined for at least the reasons 
stated above and the rejection should be reversed. 

B. Claims 1-6. 8-20 and 22-32 are not Unpatentable under 35 U.S.C. $ 
103(a) 

Claims 1-6, 8-20 and 22-32 are in the case and under final rejection of the 
Examiner rejected under 35 U.S.C. § 103(a) as allegedly being rendered obvious by 
U.S. Patent No. 5,367,464 to Abumehdi, et al. ("Abumehdi '464") in view of U.S. Patent 
No. 6,061,668 to Sharrow ("Sharrow '668"). 

In rejecting a claim under 35 U.S.C. §103, the Examiner is charged with the initial 
burden for providing a factual basis to support the obviousness conclusion. In re 
Warner, 379 F.2d 1011 , 154 USPQ 173 (CCPA 1967); In re Lunsford, 375 F.2d 385, 
148 USPQ 721 (CCPA 1966); In re Freed, 425 F.2d 785, 165 USPQ 570 (CCPA 1970). 
The Examiner is also required to explain how and why one having ordinary skill in the 
art would have been led to modify an applied reference and/or combine applied 
references to arrive at the claimed invention. In re Ochiai, 37 USPQ2d 1 127 (Fed. Cir. 
1995); in re Deuel, 51 F.3d 1552, 34 USPQ 1210 (Fed. Cir. 1995); In re Fritch, 972 F.2d 
1260, 23 USPQ 1780 (Fed. Cir. 1992); Uniroyal, Inc. v. Rudkin-Wiley Corp., 837 F.2d 
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1044, 5 USPQ2d 1434 (Fed. Cir. 1988). In establishing the requisite motivation, it has 
been consistently held that both the suggestion and reasonable expectation of success 
must stem from the prior art itself, as a whole. In re Ochiai, supra; In re Vaeck, 947 
F.2d 488, 20 USPQ2d 1438 (Fed. Cir. 1991); In re Fine, 837 F.2d 1071, 5 USPQ2d 
1596 (Fed. Cir. 1988); In re Dow Chemical Co., 837 F.2d 469, 5 USPQ2d 1529 (Fed. 
Cir. 1988). 

In the September 22, 2004 Final Office Action, the Examiner rejected claims 1-6, 
8-20 and 22-32 under 35 U.S.C. section 103(a). 

Appellants respectfully disagree with the rejection and urge its reversal for at 
least the reasons stated below. 

Claim 1 is directed to a method for auditing a database having a plurality of 

records wherein each record is accessible through at least one of a plurality of 

independent modules and is shown below: 

1. A method for auditing a database comprising a 
plurality of records, said records each being accessible 
through at least one of a plurality of independent modules, 
said method comprising the steps of: 

a) maintaining a set of additive audit data in each of 
said modules : 

b) controlling said modules so that each module 
increments a set of audit data maintained in said module 
when a record is accessed through said module; 

c) summing said sets of audit data to generate system 
audit data : and 

d) verifying said database's integrity against said 
system audit data , (emphasis added). 



The Examiner cites to Abumehdi '464 that teaches a single postage meter record 
system that necessarily includes an audit mechanism that is required of every current 
stand-alone postage meter. The U.S. postal system requires that postage meters use 
prepaid postage that is stored in a postage meter. A typical postage meter includes an 
ascending register that stores a running total of ail postage dispensed by the meter and 
a descending register that stores the remaining amount of postage credited to the 
meter. Typically, a postage meter also includes a control sum register that provides a 
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check upon the descending and ascending registers and that stores a running account 

of the total funds being added into the meter. Such a control sum register must always 

correspond with the summed readings of the ascending and descending registers. 

The Examiner ignores the elements relating to a plurality of input modules, each 

having a set of audit data that may all be summed to calculate a system audit data. The 

Examiner previously stated that 

Abumehdi does not specifically teach said records 
being access [sic] through a plurality of modules , (emphasis 
in original) (12/27/02 Office Action, section 3). 

The Examiner now asserts that °a plurality of independent modules" corresponds 
to the plurality of franking machines 101-1 On as shown in Fig. 1 of Abumehdi. Final 
Rejection at page 4. 

Yet, the cited references do not even suggest a plurality of input modules, let 
alone appreciate a problem of auditing records. There is absolutely no suggestion or 
motivation for plurality of database records wherein the records are each accessible 
through at least one of a plurality of independent modules. There is absolutely no 
suggestion for aggregating audit data amongst the plurality of input modules to obtain a 
system audit data. 

Accordingly, the Examiner has failed to establish a prima facie case for an 
obviousness rejection. 

As discussed above, the references are not property combined. Furthermore, 
even if the references were to be found to be properly combined, the references do not 
teach or fairly suggest the invention as presently claimed and in particular do not teach 
or suggest a plurality of database records wherein the records are each accessible 
through at least one of a plurality of independent modules. Additionally, the references 
do not teach or fairly suggest summing said sets of audit data . Further still, the 
references do not teach or fairly suggest a system in which each module maintains a 
set of audit data and in which each module increments a set of audit data . Furthermore, 
the Sharrow '668 reference does not teach or fairly suggest summing said sets of audit 
data to generate system audit data: and verifying said database's integrity against said 
system audit data. 
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Additionally, other claimed elements are not taught or suggested by the cited 
references. Independent claim 15 includes similar elements and is patentable over the 
cited references for at least the same reasons. The referenced dependent claims are 
patentable over the cited references for at least the reasons discussed above regarding 
the respective independent claims. For at least the above stated reasons, Appellants 
respectfully submit that the final rejection as to claims 1-3, 5, 9-12, 15-18, 20 and 22-26 
is in error and should be reversed. 

Regarding claims 2, 9, 16 and 24, claim 2 recites: 

2. A method as described in claim 1 comprising the further steps 

of: 

a) sending a user request for access to a record and said 
requested record to a selected one of said modules : and 

b) said selected module updating said requested record in 
accordance with said request . 

There is absolutely no teaching or suggestion in Abumehdi of sending a user request to 
a module. At best, the resetting terminal receives postage refill requests from one or 
more franking machines 10. Abumehdi '464 does not teach or fairly suggest "sending a 
user request for access to a record and said requested record to a selected one of said 
modules" since the one meter of Abumehdi '464 must be used for the transaction and 
there need be no selection. Accordingly, the Examiner has failed to establish a prima 
facie case for an obviousness rejection. 

For at least these reasons, Appellants respectfully submit that the final rejection 
as to claims 2, 9, 16 and 24 are in error and should be reversed. 

Regarding the rejection of claims 4, 10 and 20, Claim 4 depends indirectly from 
claim 1 and is patentable for at least the reasons as described above with reference to 
claim 1 . 

Furthermore, claim 4 recites: 

4. A method as described in claim 3 wherein said 
request includes a request for a digital postal indicium and 
comprises the further steps of: 
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a) controlling said selected module to generate and 
return to said requesting user a digital postal indicium in 
accordance with said request ; and 

b) controlling said selected module to update said 
requested record in accordance with said request, 
(emphasis added). 

The Examiner has not shown a reference or properly combined references 
teaching or suggesting at least the element emphasized above. The examiner cites 
solely to the operation of a stand alone postage meter in generating a postage indicia 
without considering the other limitation of the claims. Abumehdi '454 does not teach or 
fairly suggest a "selected module" since the one meter of Abumehdi '464 must be used 
for the transaction and there need be no selection. 

Accordingly, the Examiner has failed to establish a prima facie case for an 
obviousness rejection. 

For at least these reasons, Appellants respectfully submit that the final rejection 
as to claims 4, 10 and 20 are in error and should be reversed. 

Regarding the rejection of claims 6 and 19, Claim 6 depends indirectly from daim 
1 and is patentable for at least the reasons as described above with reference to claim 
1. 

Furthermore, claim 6 recites: 

6. A method as described in claim 2 wherein said selected module 
incorporates time information in said audit data . 

The Examiner has not shown a reference or properly combined references 
teaching or suggesting at least the element emphasized above. Sharrow '668 stores 
time data in its transaction data, but does not process audit data. 

Accordingly, the Examiner has failed to establish a prima facie case for an 
obviousness rejection. 

For at least these reasons, Appellants respectfully submit that the final rejection 
as to claims 6 and 1 9 are in error and should be reversed. 
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Regarding the rejection of claims 8 and 22, Claim 8 depends directly from claim 1 

and is patentable for at least the reasons as described above with reference to claim 1 . 

Furthermore, claim 8 recites: 

8. A method as described in claim 1 wherein said sets 
of audit data comprise increments of a linear error correcting 
code for correcting a field of said records, whereby said audit 
data can be summed to generate a system error correcting 
code to correct said field of said records, (emphasis added). 

The Examiner has not shown a reference or properly combined references 
teaching or suggesting at least the element emphasized above, Abumehdi '464 does 
not teach or fairly suggest a "linear error correcting code" since the one meter of 
Abumehdi '464 merely checks multiple registers. Accordingly, the Examiner has failed 
to establish a prima facie case for an obviousness rejection. 

For at least these reasons, Appellants respectfully submit that the final rejection 
as to claims 8 and 22 are in error and should be reversed. 



Regarding claims 13, 14, 27 and 28, Claim 13 depends indirectly from claim 1 
and claim 14 is directly dependent from claim 13. Claim 27 depends indirectly from 
claim 15 and includes elements similar to those of claim 13. Claim 28 depends from 
claim 27. These claims are patentable for at least the reasons as described above with j 
reference to claims 1 and 15. Additionally, they are patentable over the cited reference 
for the following reason. 

Claim 13 recites: 

13. A method as described in claim 8 wherein said 
sets of audit data further comprise arithmetic totals for 
values stored in said field of said records, whereby 
arithmetic sums of said values across said modules can be 
compared with arithmetic sums across said records. 
whereby numbers of errors greater than the number which 
can be detected by said system error correcting code can be 
detected, (emphasis added). 

The Examiner has not provided any reference or combination of reference 
teaching or fairly suggesting the element emphasized above. Abumehdi '464 does not 
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teach or fairly suggest arithmetic sums of said values across said modules or an error 
correcting code since the one meter of Abumehdi '464 merely checks multiple registers. 

For at least these reasons, Appellants respectfully submit that the final rejection 
as to claims 13, 14, 27 and 28 is in error and should be reversed. 



Regarding the rejection of claims 29-32, Claim 29 recites: 

29. A method for auditing a database comprising a 
plurality of records, said records each being accessible 
through at least two of a plurality of independent modules, 
said method comprising: 

maintaining a set of additive audit data in each 
of said modules : 

controlling said modules so that each module 
increments a set of audit data maintained in said module 
when a record is accessed through said module; 

summing said sets of audit data to generate 
system audit data; and 

verifying said database's integrity against said system 
audit data , (emphasis added). 

The Examiner has not shown a reference or properly combined references 
teaching or suggesting at least the element emphasized above. 

Accordingly, the Examiner has failed to establish a prima facie case for an 
obviousness rejection. 

Furthermore, daim 30 recites: 

30. A method according to claim 29 further comprising: 
controlling said modules so that each module sends a copy of audit 

data maintained in said module to a server after a record is accessed 

through said module. 

The cited references do not teach sending a copy of the audit data to the server 
after a record is accessed. 

For at least these reasons, Appellants respectfully submit that the final rejection 
as to claims 29-32 are in error and should be reversed. 



C. Claims 7 and 21 Are Not Unpatentable Under 35 U.S.C. section 103(a) 
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Claims 7 and 21 are in the case and under final rejection of the Examiner 
rejected under 35 U.S.C. § 103(a) as allegedly being rendered obvious by U.S. Patent 
No. 5,367,464 to Abumehdi, et al. ("Abumehdi l 464") in view of U.S. Patent No. 
6,061,668 to Sharrow ("Sharrow '668*) and further in view of U.S. Patent No. 5,778,076 
to Kara, et al. ("Kara '076"). 

The daims discussed in this section depend directly or indirectly from claims 1 
and 15 respectively and are patentable over the cited references for at least the reasons 
described above with reference to claims 1 and 15 and the improper combination of 
references. 

For example, claim 21 recites: 

21 . A system as described in claim 15 wherein each of said 
modules is physically secured against tampering. 

Sharrow '668 does not appreciate any security risk and there is absolutely no 
motivation to combine Kara '076 with Sharrow '668. 

For at least these reasons, Appellants respectfully submit that the final rejection 
as to claims 7 and 21 is in error and should be reversed. 

IX. Conclusion 

In Conclusion, Appellants respectfully submit that the final rejection of claims 1- 
32 is in error for at least the reasons given above and should, therefore, be reversed. 



Respectfully submitted, 




George M. Macdonald 
Reg. No. 39,284 
Attorney for the Appellants 
Telephone (203) 924-3180 



PITNEY BOWES INC. 

Intellectual Property and Technology Law Department 
35 Waterview Drive, P.O. Box 3000 
Shelton, CT 06484-8000 
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VIII - CLAIMS APPENDIX 
APPENDIX A 

1 . A method for auditing a database comprising a plurality of records, said 
records each being accessible through at least one of a plurality of independent 
modules, said method comprising the steps of: 

a) maintaining a set of additive audit data in each of said modules; 

b) controlling said modules so that each module increments a set of audit data 
maintained in said module when a record is accessed through said module; 

c) summing said sets of audit data to generate system audit data; and 

d) verifying said database's integrity against said system audit data. 

2. A method as described in claim 1 comprising the further steps of: 

a) sending a user request for access to a record and said requested record to a 
selected one of said modules; and 

b) said selected module updating said requested record in accordance with said 
request . 

3. A method as described in claim 2 wherein said selected module incorporates 
cryptographically processed information in said record to prevent generation of 
fraudulent records. 

4. A method as described in claim 3 wherein said request 

includes a request for a digital postal indicium and comprises the further steps of: 
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a) controlling said selected module to generate and return to said requesting user 
a digital postal indicium in accordance with said request; and 

b) controlling said selected module to update said requested record in 
accordance with said request. 

5. A method as described in claim 2 wherein said selected module incorporates 
encrypted information in said audit data to authenticate said audit data. 

6. A method as described in claim 2 wherein said selected module incorporates 
time information in said audit data. 

7. A method as described in claim 1 comprising the further step of providing 
security against tampering for each of said modules. 

8. A method as described in claim 1 wherein said sets of audit data comprise 
increments of a linear error correcting code for correcting a field of said records, 
whereby said audit data can be summed to generate a system error correcting code to 
correct said field of said records. 

9. A method as described in claim 8 comprising the further steps of: 

a) sending a user request for access to a record and said requested record to a 
selected one of said modules; and 

j 

i 
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b) said selected module updating said requested record in accordance with said 
request . 

10. A method as described in claim 9 wherein said request 

includes a request for a digital postal indicium and comprising the further steps of: 

a) controlling said selected module to generate and return to said requesting user 
a digital postal indicium in accordance with said request; and 

b) controlling said selected module to update said requested record in 
accordance with said request. 

1 1 . A method as described in claim 10 wherein said corrected field contains a 
total postage amount for the corresponding record. 

12. A method as described in claim 10 wherein said corrected field contains a 
total number of indica dispensed for the corresponding record. 

13. A method as described in claim 8 wherein said sets of audit data further 
comprise arithmetic totals for values stored in said field of said records, whereby 

i 
t 

arithmetic sums of said values across said modules can be compared with arithmetic j 

sums across said records, whereby numbers of errors greater than the number which ! 

| 

i 

can be detected by said system error correcting code can be detected. 
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14. A method as described in claim 13 wherein said field contains a total 
postage amount or a total number of indica dispensed. 

15. A database system comprising: 

a) a data store storing a database comprising a plurality of records; 

b) a server maintaining said records; 

c) a plurality of independent modules providing access to said records; wherein 

d) said modules are programmed to maintain a set of additive audit data in each 
of said modules and increment a set of audit data maintained in one of said modules 
when a record is accessed through said one module; 

e) said server is programmed to sum said sets of audit data to generate system 
audit data and verify said database's integrity against said system audit data. 

16. A system as described in claim 15 wherein: 

a) said server is further programmed to receive user requests for access and 
send said user request and said requested record to a selected one of said modules; 
and 

b) said modules are further programmed so that said selected module updates 
said requested record in accordance with said request . 

17. A system as described in claim 16 wherein said modules are further 
programmed so that said selected module incorporates encrypted information in said 
record to prevent generation of fraudulent records. 
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1 8. A system as described in claim 1 6 wherein said selected module 
incorporates encrypted information in said audit data to authenticate said audit data. 

19. A system as described in claim 1 6 wherein said selected module 
incorporates time information in said audit data. 

20. A system as described in claim 17 wherein said request includes a request 
for a digital postal indicium and wherein said modules are further programmed so that 
said selected module generates and returns to said requesting user a digital postal 
indicium in accordance with said request; and updates said requested record in 
accordance with said request. 

21 . A system as described in claim 15 wherein each of said modules is 
physically secured against tampering. 

22. A system as described in claim 15 wherein said sets of audit data comprise 
increments of a linear error correcting code for correcting a field of said records, 
whereby said audit data can be summed by said server to generate a system error 
correcting code to correct said field of said records. 
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23. A system as described in claim 22 wherein said modules are further 
programmed so that said selected module incorporates encrypted information in said 
record to prevent generation of fraudulent records. 

24. A system as described in claim 23 wherein said request includes a request 
for a digital postal indicium and wherein said modules are further programmed so that 
said selected module generates and returns to said requesting user a digital postal 
indicium in accordance with said request; and updates said requested record in 
accordance with said request. 

25. A system as described in claim 24 wherein said corrected field contains a 
total postage amount for the corresponding record. 

26. A system as described in claim 24 wherein said corrected field contains a 
total number of indicia dispensed for the corresponding record. 

27. A system as described in claim 22 wherein said sets of audit data further 
comprise arithmetic totals for values stored in said field of said records, whereby 
arithmetic sums of said values across said modules can be compared with arithmetic 
sums across said records, whereby numbers of errors greater than the number which 
can be detected by said system error correcting code can be detected. 
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28. A system as described in claim 27 wherein said field contains a total postage 
amount or a total number of indicia dispensed. 

29. A method for auditing a database comprising a plurality of records, said 
records each being accessible through at least two of a plurality of independent 
modules, said method comprising: 

maintaining a set of additive audit data in each of said modules; 
controlling said modules so that each module increments a set of audit 
data maintained in said module when a record is accessed through said module; 

summing said sets of audit data to generate system audit data; and 
verifying said database's integrity against said system audit data. 

30. A method according to claim 29 further comprising: 

controlling said modules so that each module sends a copy of audit data 
maintained in said module to a server after a record is accessed through said module. 

31 . A method according to claim 30 wherein: 

summing said sets of audit data utilizes at least one set of the copy audit 
data maintained on the server. 

32. A method according to claim 29 further comprising: j 

i 

controlling said modules so that each module updates an error correcting j 
code after a record is accessed through said module. 
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